[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ESKBN78WGVNAEVWBSMF280":3,"skill-same:01M6ESKBN78WGVNAEVWBSMF280":147},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":68,"commitSha":69,"skillDirectory":70,"forksCount":14,"repositoryHtmlUrl":71,"repositoryHomepageUrl":72,"ownerHtmlUrl":73,"ownerBlogUrl":6,"ownerDescription":74,"updatedAt":75,"install":76,"resources":89},"01M6ESKBN78WGVNAEVWBSMF280","analyzing-dns-logs-for-exfiltration",null,"Analyzes DNS query logs to detect data exfiltration via DNS tunneling, DGA domain communication, and covert C2 channels using entropy analysis, query volume anomalies, and subdomain length detection in SIEM platforms. Use when SOC teams need to identify DNS-based threats that bypass traditional network security controls.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-dns-logs-for-exfiltration\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"logs","dns","exfiltration","analyzing dns logs for exfiltration","analyzing","threat-detection","volume","query","cm","subdomain","aml","analysis","entropy","network security","splunk","dga","dns-tunneling","soc","siem","cybersecurity","2026-11-10 10:12:30",false,"---\nname: analyzing-dns-logs-for-exfiltration\ndescription: 'Analyzes DNS query logs to detect data exfiltration via DNS tunneling,\n  DGA domain communication, and covert C2 channels using entropy analysis, query volume\n  anomalies, and subdomain length detection in SIEM platforms. Use when SOC teams\n  need to identify DNS-based threats that bypass traditional network security controls.\n\n  '\ndomain: cybersecurity\nsubdomain: soc-operations\ntags:\n- soc\n- dns\n- exfiltration\n- dns-tunneling\n- dga\n- c2-detection\n- splunk\n- threat-detection\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\natlas_techniques:\n- AML.T0024\n- AML.T0056\n- AML.T0086\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- RS.MA-01\n- DE.AE-06\nmitre_attack:\n- T1048.003\n- T1071.004\n- T1567\n---\n# Analyzing DNS Logs for Exfiltration\n\n## When to Use\n\nUse this skill when:\n- SOC teams suspect data exfiltration through DNS tunneling to bypass firewall\u002Fproxy controls\n- Threat intelligence indicates adversaries using DNS-based C2 channels (e.g., Cobalt Strike DNS beacon)\n- UEBA detects anomalous DNS query volumes from specific hosts\n- Malware analysis reveals DNS-over-HTTPS (DoH) or DNS tunneling capabilities\n\n**Do not use** for standard DNS troubleshooting or availability monitoring — this skill focuses on security-relevant DNS abuse detection.\n\n## Prerequisites\n\n- DNS query logging enabled (Windows DNS Server, Bind, Infoblox, or Cisco Umbrella)\n- DNS logs ingested into SIEM (Splunk with `Stream:DNS`, `dns` sourcetype, or Zeek DNS logs)\n- Passive DNS data for historical domain resolution analysis\n- Baseline of normal DNS behavior (query volume, domain distribution, TXT record frequency)\n- Python with `math` and `collections` libraries for entropy calculation\n\n## Workflow\n\n### Step 1: Detect DNS Tunneling via Subdomain Length Analysis\n\nDNS tunneling encodes data in subdomain labels, creating unusually long queries:\n\n```spl\nindex=dns sourcetype=\"stream:dns\" query_type IN (\"A\", \"AAAA\", \"TXT\", \"CNAME\", \"MX\")\n| eval domain_parts = split(query, \".\")\n| eval subdomain = mvindex(domain_parts, 0, mvcount(domain_parts)-3)\n| eval subdomain_str = mvjoin(subdomain, \".\")\n| eval subdomain_len = len(subdomain_str)\n| eval tld = mvindex(domain_parts, -1)\n| eval registered_domain = mvindex(domain_parts, -2).\".\".tld\n| where subdomain_len > 50\n| stats count AS queries, dc(query) AS unique_queries,\n        avg(subdomain_len) AS avg_subdomain_len,\n        max(subdomain_len) AS max_subdomain_len,\n        values(src_ip) AS sources\n  by registered_domain\n| where queries > 20\n| sort - avg_subdomain_len\n| table registered_domain, queries, unique_queries, avg_subdomain_len, max_subdomain_len, sources\n```\n\n### Step 2: Detect High-Entropy Domain Queries (DGA Detection)\n\nDomain Generation Algorithms produce random-looking domains:\n\n```spl\nindex=dns sourcetype=\"stream:dns\"\n| eval domain_parts = split(query, \".\")\n| eval sld = mvindex(domain_parts, -2)\n| eval sld_len = len(sld)\n| eval char_count = sld_len\n| eval vowels = len(replace(sld, \"[^aeiou]\", \"\"))\n| eval consonants = len(replace(sld, \"[^bcdfghjklmnpqrstvwxyz]\", \"\"))\n| eval digits = len(replace(sld, \"[^0-9]\", \"\"))\n| eval vowel_ratio = if(char_count > 0, vowels \u002F char_count, 0)\n| eval digit_ratio = if(char_count > 0, digits \u002F char_count, 0)\n| where sld_len > 12 AND (vowel_ratio \u003C 0.2 OR digit_ratio > 0.3)\n| stats count AS queries, dc(query) AS unique_domains, values(src_ip) AS sources\n  by query\n| where unique_domains > 10\n| sort - queries\n```\n\n**Python-based Shannon Entropy Calculation for DNS queries:**\n\n```python\nimport math\nfrom collections import Counter\n\ndef shannon_entropy(text):\n    \"\"\"Calculate Shannon entropy of a string\"\"\"\n    if not text:\n        return 0\n    counter = Counter(text.lower())\n    length = len(text)\n    entropy = -sum(\n        (count \u002F length) * math.log2(count \u002F length)\n        for count in counter.values()\n    )\n    return round(entropy, 4)\n\n# Test with examples\nnormal_domain = \"google\"           # Low entropy\ndga_domain = \"x8kj2m9p4qw7n\"      # High entropy\ntunnel_subdomain = \"aGVsbG8gd29ybGQ.evil.com\"  # Base64 encoded data\n\nprint(f\"Normal: {shannon_entropy(normal_domain)}\")     # ~2.25\nprint(f\"DGA:    {shannon_entropy(dga_domain)}\")         # ~3.70\nprint(f\"Tunnel: {shannon_entropy(tunnel_subdomain)}\")   # ~3.50\n\n# Threshold: entropy > 3.5 for subdomain = likely tunneling\u002FDGA\n```\n\n**Splunk implementation of entropy scoring:**\n\n```spl\nindex=dns sourcetype=\"stream:dns\"\n| eval domain_parts = split(query, \".\")\n| eval check_string = mvindex(domain_parts, 0)\n| eval check_len = len(check_string)\n| where check_len > 8\n| eval chars = split(check_string, \"\")\n| stats count AS total_chars, dc(chars) AS unique_chars by query, src_ip, check_string, check_len\n| eval entropy_estimate = log(unique_chars, 2) * (unique_chars \u002F check_len)\n| where entropy_estimate > 3.5\n| stats count AS high_entropy_queries, dc(query) AS unique_queries by src_ip\n| where high_entropy_queries > 50\n| sort - high_entropy_queries\n```\n\n### Step 3: Detect Anomalous DNS Query Volume\n\nIdentify hosts generating abnormal DNS traffic:\n\n```spl\nindex=dns sourcetype=\"stream:dns\" earliest=-24h\n| bin _time span=1h\n| stats count AS queries, dc(query) AS unique_domains by src_ip, _time\n| eventstats avg(queries) AS avg_queries, stdev(queries) AS stdev_queries by src_ip\n| eval z_score = (queries - avg_queries) \u002F stdev_queries\n| where z_score > 3 OR queries > 5000\n| sort - z_score\n| table _time, src_ip, queries, unique_domains, avg_queries, z_score\n```\n\n**Detect TXT record abuse (common tunneling method):**\n\n```spl\nindex=dns sourcetype=\"stream:dns\" query_type=\"TXT\"\n| stats count AS txt_queries, dc(query) AS unique_txt_domains,\n        values(query) AS domains by src_ip\n| where txt_queries > 100\n| eval suspicion = case(\n    txt_queries > 1000, \"CRITICAL — Likely DNS tunneling\",\n    txt_queries > 500, \"HIGH — Possible DNS tunneling\",\n    txt_queries > 100, \"MEDIUM — Unusual TXT volume\"\n  )\n| sort - txt_queries\n| table src_ip, txt_queries, unique_txt_domains, suspicion\n```\n\n### Step 4: Detect Known DNS Tunneling Tools\n\nSearch for signatures of common DNS tunneling tools:\n\n```spl\nindex=dns sourcetype=\"stream:dns\"\n| eval query_lower = lower(query)\n| where (\n    match(query_lower, \"\\.dnscat\\.\") OR\n    match(query_lower, \"\\.dns2tcp\\.\") OR\n    match(query_lower, \"\\.iodine\\.\") OR\n    match(query_lower, \"\\.dnscapy\\.\") OR\n    match(query_lower, \"\\.cobalt.*\\.beacon\") OR\n    query_type=\"NULL\" OR\n    (query_type=\"TXT\" AND len(query) > 100)\n  )\n| stats count by src_ip, query, query_type\n| sort - count\n```\n\n**Detect DNS over HTTPS (DoH) bypassing local DNS:**\n\n```spl\nindex=proxy OR index=firewall\ndest IN (\"1.1.1.1\", \"1.0.0.1\", \"8.8.8.8\", \"8.8.4.4\",\n         \"9.9.9.9\", \"149.112.112.112\", \"208.67.222.222\")\ndest_port=443\n| stats sum(bytes_out) AS total_bytes, count AS connections by src_ip, dest\n| where connections > 100 OR total_bytes > 10485760\n| eval alert = \"Possible DoH bypass — DNS queries sent over HTTPS to public resolver\"\n| sort - total_bytes\n```\n\n### Step 5: Correlate DNS Findings with Endpoint Data\n\nCross-reference suspicious DNS with process data:\n\n```spl\nindex=dns src_ip=\"192.168.1.105\" query=\"*.evil-tunnel.com\" earliest=-24h\n| stats count AS dns_queries, earliest(_time) AS first_query, latest(_time) AS last_query\n  by src_ip, query\n| join src_ip [\n    search index=sysmon EventCode=3 DestinationPort=53 Computer=\"WORKSTATION-042\"\n    | stats count AS connections, values(Image) AS processes by SourceIp\n    | rename SourceIp AS src_ip\n  ]\n| table src_ip, query, dns_queries, first_query, last_query, processes\n```\n\n### Step 6: Calculate Data Exfiltration Volume Estimate\n\nEstimate data volume encoded in DNS queries:\n\n```spl\nindex=dns src_ip=\"192.168.1.105\" query=\"*.evil-tunnel.com\" earliest=-24h\n| eval domain_parts = split(query, \".\")\n| eval encoded_data = mvindex(domain_parts, 0)\n| eval encoded_bytes = len(encoded_data)\n| eval decoded_bytes = encoded_bytes * 0.75  -- Base64 decoding factor\n| stats sum(decoded_bytes) AS total_bytes_estimated, count AS total_queries,\n        earliest(_time) AS first_seen, latest(_time) AS last_seen\n| eval estimated_kb = round(total_bytes_estimated \u002F 1024, 1)\n| eval estimated_mb = round(total_bytes_estimated \u002F 1048576, 2)\n| eval duration_hours = round((last_seen - first_seen) \u002F 3600, 1)\n| eval rate_kbps = round(estimated_kb \u002F (duration_hours * 3600) * 8, 2)\n| table total_queries, estimated_mb, duration_hours, rate_kbps, first_seen, last_seen\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **DNS Tunneling** | Technique encoding data within DNS queries\u002Fresponses to exfiltrate data or establish C2 channels through DNS |\n| **DGA** | Domain Generation Algorithm — malware technique generating pseudo-random domain names for C2 resilience |\n| **Shannon Entropy** | Mathematical measure of randomness in a string — high entropy (>3.5) in domain names indicates DGA or tunneling |\n| **TXT Record Abuse** | Using DNS TXT records (designed for text data) as a high-bandwidth channel for data tunneling |\n| **DNS over HTTPS (DoH)** | DNS queries encrypted over HTTPS (port 443), bypassing traditional DNS monitoring |\n| **Passive DNS** | Historical record of DNS resolutions showing which IPs a domain resolved to over time |\n\n## Tools & Systems\n\n- **Splunk Stream**: Network traffic capture add-on providing parsed DNS query data for SIEM analysis\n- **Zeek (Bro)**: Network security monitor generating detailed DNS transaction logs for analysis\n- **Cisco Umbrella (OpenDNS)**: Cloud DNS security platform blocking malicious domains and logging query data\n- **Infoblox DNS Firewall**: DNS-layer security providing RPZ-based blocking and detailed query logging\n- **Farsight DNSDB**: Passive DNS database for historical domain resolution lookups and infrastructure mapping\n\n## Common Scenarios\n\n- **Cobalt Strike DNS Beacon**: Detect periodic TXT queries with encoded payloads to C2 domain\n- **Data Exfiltration**: Large volumes of unique subdomain queries encoding stolen data in Base64\u002Fhex\n- **DGA Malware**: Detect DNS queries to algorithmically generated domains (high entropy, no web content)\n- **DNS-over-HTTPS Bypass**: Employee using DoH to bypass corporate DNS filtering and monitoring\n- **Slow Drip Exfiltration**: Low-volume DNS tunneling staying below threshold alerts (requires baseline comparison)\n\n## Output Format\n\n```\nDNS EXFILTRATION ANALYSIS — WORKSTATION-042\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nPeriod:       2024-03-14 to 2024-03-15\nSource:       192.168.1.105 (WORKSTATION-042, Finance Dept)\n\nFindings:\n  [CRITICAL] DNS tunneling detected to evil-tunnel[.]com\n    Query Volume:       12,847 queries in 18 hours\n    Avg Subdomain Len:  63 characters (normal: \u003C20)\n    Avg Entropy:        3.82 (threshold: 3.5)\n    Query Types:        TXT (89%), A (11%)\n    Estimated Data:     ~4.7 MB exfiltrated via DNS\n    Rate:               0.58 kbps (slow drip pattern)\n\n  [HIGH] DGA-like domains resolved\n    Unique DGA Domains: 247 domains resolved\n    Pattern:            15-char random alphanumeric.xyz TLD\n    Entropy Range:      3.6 - 4.1\n\nProcess Attribution:\n  Process:   svchost_update.exe (masquerading — not legitimate svchost)\n  PID:       4892\n  Parent:    explorer.exe\n  Hash:      SHA256: a1b2c3d4... (VT: 34\u002F72 malicious — Cobalt Strike beacon)\n\nContainment:\n  [DONE] Host isolated via EDR\n  [DONE] Domain evil-tunnel[.]com added to DNS sinkhole\n  [DONE] Incident IR-2024-0448 created\n```\n","# Analyzing DNS Logs for Exfiltration\n\n## When to Use\n\nUse this skill when:\n- SOC teams suspect data exfiltration through DNS tunneling to bypass firewall\u002Fproxy controls\n- Threat intelligence indicates adversaries using DNS-based C2 channels (e.g., Cobalt Strike DNS beacon)\n- UEBA detects anomalous DNS query volumes from specific hosts\n- Malware analysis reveals DNS-over-HTTPS (DoH) or DNS tunneling capabilities\n\n**Do not use** for standard DNS troubleshooting or availability monitoring — this skill focuses on security-relevant DNS abuse detection.\n\n## Prerequisites\n\n- DNS query logging enabled (Windows DNS Server, Bind, Infoblox, or Cisco Umbrella)\n- DNS logs ingested into SIEM (Splunk with `Stream:DNS`, `dns` sourcetype, or Zeek DNS logs)\n- Passive DNS data for historical domain resolution analysis\n- Baseline of normal DNS behavior (query volume, domain distribution, TXT record frequency)\n- Python with `math` and `collections` libraries for entropy calculation\n\n## Workflow\n\n### Step 1: Detect DNS Tunneling via Subdomain Length Analysis\n\nDNS tunneling encodes data in subdomain labels, creating unusually long queries:\n\n```spl\nindex=dns sourcetype=\"stream:dns\" query_type IN (\"A\", \"AAAA\", \"TXT\", \"CNAME\", \"MX\")\n| eval domain_parts = split(query, \".\")\n| eval subdomain = mvindex(domain_parts, 0, mvcount(domain_parts)-3)\n| eval subdomain_str = mvjoin(subdomain, \".\")\n| eval subdomain_len = len(subdomain_str)\n| eval tld = mvindex(domain_parts, -1)\n| eval registered_domain = mvindex(domain_parts, -2).\".\".tld\n| where subdomain_len > 50\n| stats count AS queries, dc(query) AS unique_queries,\n        avg(subdomain_len) AS avg_subdomain_len,\n        max(subdomain_len) AS max_subdomain_len,\n        values(src_ip) AS sources\n  by registered_domain\n| where queries > 20\n| sort - avg_subdomain_len\n| table registered_domain, queries, unique_queries, avg_subdomain_len, max_subdomain_len, sources\n```\n\n### Step 2: Detect High-Entropy Domain Queries (DGA Detection)\n\nDomain Generation Algorithms produce random-looking domains:\n\n```spl\nindex=dns sourcetype=\"stream:dns\"\n| eval domain_parts = split(query, \".\")\n| eval sld = mvindex(domain_parts, -2)\n| eval sld_len = len(sld)\n| eval char_count = sld_len\n| eval vowels = len(replace(sld, \"[^aeiou]\", \"\"))\n| eval consonants = len(replace(sld, \"[^bcdfghjklmnpqrstvwxyz]\", \"\"))\n| eval digits = len(replace(sld, \"[^0-9]\", \"\"))\n| eval vowel_ratio = if(char_count > 0, vowels \u002F char_count, 0)\n| eval digit_ratio = if(char_count > 0, digits \u002F char_count, 0)\n| where sld_len > 12 AND (vowel_ratio \u003C 0.2 OR digit_ratio > 0.3)\n| stats count AS queries, dc(query) AS unique_domains, values(src_ip) AS sources\n  by query\n| where unique_domains > 10\n| sort - queries\n```\n\n**Python-based Shannon Entropy Calculation for DNS queries:**\n\n```python\nimport math\nfrom collections import Counter\n\ndef shannon_entropy(text):\n    \"\"\"Calculate Shannon entropy of a string\"\"\"\n    if not text:\n        return 0\n    counter = Counter(text.lower())\n    length = len(text)\n    entropy = -sum(\n        (count \u002F length) * math.log2(count \u002F length)\n        for count in counter.values()\n    )\n    return round(entropy, 4)\n\n# Test with examples\nnormal_domain = \"google\"           # Low entropy\ndga_domain = \"x8kj2m9p4qw7n\"      # High entropy\ntunnel_subdomain = \"aGVsbG8gd29ybGQ.evil.com\"  # Base64 encoded data\n\nprint(f\"Normal: {shannon_entropy(normal_domain)}\")     # ~2.25\nprint(f\"DGA:    {shannon_entropy(dga_domain)}\")         # ~3.70\nprint(f\"Tunnel: {shannon_entropy(tunnel_subdomain)}\")   # ~3.50\n\n# Threshold: entropy > 3.5 for subdomain = likely tunneling\u002FDGA\n```\n\n**Splunk implementation of entropy scoring:**\n\n```spl\nindex=dns sourcetype=\"stream:dns\"\n| eval domain_parts = split(query, \".\")\n| eval check_string = mvindex(domain_parts, 0)\n| eval check_len = len(check_string)\n| where check_len > 8\n| eval chars = split(check_string, \"\")\n| stats count AS total_chars, dc(chars) AS unique_chars by query, src_ip, check_string, check_len\n| eval entropy_estimate = log(unique_chars, 2) * (unique_chars \u002F check_len)\n| where entropy_estimate > 3.5\n| stats count AS high_entropy_queries, dc(query) AS unique_queries by src_ip\n| where high_entropy_queries > 50\n| sort - high_entropy_queries\n```\n\n### Step 3: Detect Anomalous DNS Query Volume\n\nIdentify hosts generating abnormal DNS traffic:\n\n```spl\nindex=dns sourcetype=\"stream:dns\" earliest=-24h\n| bin _time span=1h\n| stats count AS queries, dc(query) AS unique_domains by src_ip, _time\n| eventstats avg(queries) AS avg_queries, stdev(queries) AS stdev_queries by src_ip\n| eval z_score = (queries - avg_queries) \u002F stdev_queries\n| where z_score > 3 OR queries > 5000\n| sort - z_score\n| table _time, src_ip, queries, unique_domains, avg_queries, z_score\n```\n\n**Detect TXT record abuse (common tunneling method):**\n\n```spl\nindex=dns sourcetype=\"stream:dns\" query_type=\"TXT\"\n| stats count AS txt_queries, dc(query) AS unique_txt_domains,\n        values(query) AS domains by src_ip\n| where txt_queries > 100\n| eval suspicion = case(\n    txt_queries > 1000, \"CRITICAL — Likely DNS tunneling\",\n    txt_queries > 500, \"HIGH — Possible DNS tunneling\",\n    txt_queries > 100, \"MEDIUM — Unusual TXT volume\"\n  )\n| sort - txt_queries\n| table src_ip, txt_queries, unique_txt_domains, suspicion\n```\n\n### Step 4: Detect Known DNS Tunneling Tools\n\nSearch for signatures of common DNS tunneling tools:\n\n```spl\nindex=dns sourcetype=\"stream:dns\"\n| eval query_lower = lower(query)\n| where (\n    match(query_lower, \"\\.dnscat\\.\") OR\n    match(query_lower, \"\\.dns2tcp\\.\") OR\n    match(query_lower, \"\\.iodine\\.\") OR\n    match(query_lower, \"\\.dnscapy\\.\") OR\n    match(query_lower, \"\\.cobalt.*\\.beacon\") OR\n    query_type=\"NULL\" OR\n    (query_type=\"TXT\" AND len(query) > 100)\n  )\n| stats count by src_ip, query, query_type\n| sort - count\n```\n\n**Detect DNS over HTTPS (DoH) bypassing local DNS:**\n\n```spl\nindex=proxy OR index=firewall\ndest IN (\"1.1.1.1\", \"1.0.0.1\", \"8.8.8.8\", \"8.8.4.4\",\n         \"9.9.9.9\", \"149.112.112.112\", \"208.67.222.222\")\ndest_port=443\n| stats sum(bytes_out) AS total_bytes, count AS connections by src_ip, dest\n| where connections > 100 OR total_bytes > 10485760\n| eval alert = \"Possible DoH bypass — DNS queries sent over HTTPS to public resolver\"\n| sort - total_bytes\n```\n\n### Step 5: Correlate DNS Findings with Endpoint Data\n\nCross-reference suspicious DNS with process data:\n\n```spl\nindex=dns src_ip=\"192.168.1.105\" query=\"*.evil-tunnel.com\" earliest=-24h\n| stats count AS dns_queries, earliest(_time) AS first_query, latest(_time) AS last_query\n  by src_ip, query\n| join src_ip [\n    search index=sysmon EventCode=3 DestinationPort=53 Computer=\"WORKSTATION-042\"\n    | stats count AS connections, values(Image) AS processes by SourceIp\n    | rename SourceIp AS src_ip\n  ]\n| table src_ip, query, dns_queries, first_query, last_query, processes\n```\n\n### Step 6: Calculate Data Exfiltration Volume Estimate\n\nEstimate data volume encoded in DNS queries:\n\n```spl\nindex=dns src_ip=\"192.168.1.105\" query=\"*.evil-tunnel.com\" earliest=-24h\n| eval domain_parts = split(query, \".\")\n| eval encoded_data = mvindex(domain_parts, 0)\n| eval encoded_bytes = len(encoded_data)\n| eval decoded_bytes = encoded_bytes * 0.75  -- Base64 decoding factor\n| stats sum(decoded_bytes) AS total_bytes_estimated, count AS total_queries,\n        earliest(_time) AS first_seen, latest(_time) AS last_seen\n| eval estimated_kb = round(total_bytes_estimated \u002F 1024, 1)\n| eval estimated_mb = round(total_bytes_estimated \u002F 1048576, 2)\n| eval duration_hours = round((last_seen - first_seen) \u002F 3600, 1)\n| eval rate_kbps = round(estimated_kb \u002F (duration_hours * 3600) * 8, 2)\n| table total_queries, estimated_mb, duration_hours, rate_kbps, first_seen, last_seen\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **DNS Tunneling** | Technique encoding data within DNS queries\u002Fresponses to exfiltrate data or establish C2 channels through DNS |\n| **DGA** | Domain Generation Algorithm — malware technique generating pseudo-random domain names for C2 resilience |\n| **Shannon Entropy** | Mathematical measure of randomness in a string — high entropy (>3.5) in domain names indicates DGA or tunneling |\n| **TXT Record Abuse** | Using DNS TXT records (designed for text data) as a high-bandwidth channel for data tunneling |\n| **DNS over HTTPS (DoH)** | DNS queries encrypted over HTTPS (port 443), bypassing traditional DNS monitoring |\n| **Passive DNS** | Historical record of DNS resolutions showing which IPs a domain resolved to over time |\n\n## Tools & Systems\n\n- **Splunk Stream**: Network traffic capture add-on providing parsed DNS query data for SIEM analysis\n- **Zeek (Bro)**: Network security monitor generating detailed DNS transaction logs for analysis\n- **Cisco Umbrella (OpenDNS)**: Cloud DNS security platform blocking malicious domains and logging query data\n- **Infoblox DNS Firewall**: DNS-layer security providing RPZ-based blocking and detailed query logging\n- **Farsight DNSDB**: Passive DNS database for historical domain resolution lookups and infrastructure mapping\n\n## Common Scenarios\n\n- **Cobalt Strike DNS Beacon**: Detect periodic TXT queries with encoded payloads to C2 domain\n- **Data Exfiltration**: Large volumes of unique subdomain queries encoding stolen data in Base64\u002Fhex\n- **DGA Malware**: Detect DNS queries to algorithmically generated domains (high entropy, no web content)\n- **DNS-over-HTTPS Bypass**: Employee using DoH to bypass corporate DNS filtering and monitoring\n- **Slow Drip Exfiltration**: Low-volume DNS tunneling staying below threshold alerts (requires baseline comparison)\n\n## Output Format\n\n```\nDNS EXFILTRATION ANALYSIS — WORKSTATION-042\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nPeriod:       2024-03-14 to 2024-03-15\nSource:       192.168.1.105 (WORKSTATION-042, Finance Dept)\n\nFindings:\n  [CRITICAL] DNS tunneling detected to evil-tunnel[.]com\n    Query Volume:       12,847 queries in 18 hours\n    Avg Subdomain Len:  63 characters (normal: \u003C20)\n    Avg Entropy:        3.82 (threshold: 3.5)\n    Query Types:        TXT (89%), A (11%)\n    Estimated Data:     ~4.7 MB exfiltrated via DNS\n    Rate:               0.58 kbps (slow drip pattern)\n\n  [HIGH] DGA-like domains resolved\n    Unique DGA Domains: 247 domains resolved\n    Pattern:            15-char random alphanumeric.xyz TLD\n    Entropy Range:      3.6 - 4.1\n\nProcess Attribution:\n  Process:   svchost_update.exe (masquerading — not legitimate svchost)\n  PID:       4892\n  Parent:    explorer.exe\n  Hash:      SHA256: a1b2c3d4... (VT: 34\u002F72 malicious — Cobalt Strike beacon)\n\nContainment:\n  [DONE] Host isolated via EDR\n  [DONE] Domain evil-tunnel[.]com added to DNS sinkhole\n  [DONE] Incident IR-2024-0448 created\n```\n",{"name":5,"tags":49,"author":51,"domain":43,"license":15,"version":52,"nist_csf":53,"subdomain":58,"description":59,"mitre_attack":60,"atlas_techniques":64},[41,25,26,40,39,50,38,29],"c2-detection","mahipal","1.0",[54,55,56,57],"DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06","soc-operations","Analyzes DNS query logs to detect data exfiltration via DNS tunneling, DGA domain communication, and covert C2 channels using entropy analysis, query volume anomalies, and subdomain length detection in SIEM platforms. Use when SOC teams need to identify DNS-based threats that bypass traditional network security controls.\n",[61,62,63],"T1048.003","T1071.004","T1567",[65,66,67],"AML.T0024","AML.T0056","AML.T0086","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fanalyzing-dns-logs-for-exfiltration","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":77,"prompt":87,"zipAvailable":88},[78,81,84],{"tool":79,"command":80},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill analyzing-dns-logs-for-exfiltration",{"tool":82,"command":83},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill analyzing-dns-logs-for-exfiltration",{"tool":85,"command":86},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill analyzing-dns-logs-for-exfiltration","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-dns-logs-for-exfiltration\u002FSKILL.md",true,[90,95,101,105,109,113,117,121,125,129,133,139,143],{"path":91,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":93,"sourceHtmlUrl":94},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-dns-logs-for-exfiltration\u002FLICENSE",{"path":96,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"references\u002Fapi-reference.md","REFERENCE","参考文档",2708,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-dns-logs-for-exfiltration\u002Freferences\u002Fapi-reference.md",{"path":102,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":103,"sourceHtmlUrl":104},"references\u002Fapplication-generation.md",7105,"https:\u002F\u002Fgithub.com\u002Flinora-u\u002FAgentLoom\u002Fblob\u002Fmain\u002Fagentloom-framework-skill\u002Freferences\u002Fapplication-generation.md",{"path":106,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":107,"sourceHtmlUrl":108},"references\u002Fconfiguration-surface.md",27989,"https:\u002F\u002Fgithub.com\u002Flinora-u\u002FAgentLoom\u002Fblob\u002Fmain\u002Fagentloom-framework-skill\u002Freferences\u002Fconfiguration-surface.md",{"path":110,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":111,"sourceHtmlUrl":112},"references\u002Ffunction-routing.md",4925,"https:\u002F\u002Fgithub.com\u002Flinora-u\u002FAgentLoom\u002Fblob\u002Fmain\u002Fagentloom-framework-skill\u002Freferences\u002Ffunction-routing.md",{"path":114,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":115,"sourceHtmlUrl":116},"references\u002Freadme-template.md",2011,"https:\u002F\u002Fgithub.com\u002Flinora-u\u002FAgentLoom\u002Fblob\u002Fmain\u002Fagentloom-framework-skill\u002Freferences\u002Freadme-template.md",{"path":118,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":119,"sourceHtmlUrl":120},"references\u002Freuse-first.md",4963,"https:\u002F\u002Fgithub.com\u002Flinora-u\u002FAgentLoom\u002Fblob\u002Fmain\u002Fagentloom-framework-skill\u002Freferences\u002Freuse-first.md",{"path":122,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":123,"sourceHtmlUrl":124},"references\u002Fshell-security-audit.md",8115,"https:\u002F\u002Fgithub.com\u002Flinora-u\u002FAgentLoom\u002Fblob\u002Fmain\u002Fagentloom-framework-skill\u002Freferences\u002Fshell-security-audit.md",{"path":126,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":127,"sourceHtmlUrl":128},"references\u002Fvalidation-and-review.md",21724,"https:\u002F\u002Fgithub.com\u002Flinora-u\u002FAgentLoom\u002Fblob\u002Fmain\u002Fagentloom-framework-skill\u002Freferences\u002Fvalidation-and-review.md",{"path":130,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":131,"sourceHtmlUrl":132},"references\u002Fyaml-contract.md",11273,"https:\u002F\u002Fgithub.com\u002Flinora-u\u002FAgentLoom\u002Fblob\u002Fmain\u002Fagentloom-framework-skill\u002Freferences\u002Fyaml-contract.md",{"path":134,"resourceType":135,"resourceTypeDesc":136,"sizeBytes":137,"sourceHtmlUrl":138},"scripts\u002Fagent.py","SCRIPT","脚本",8704,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-dns-logs-for-exfiltration\u002Fscripts\u002Fagent.py",{"path":140,"resourceType":135,"resourceTypeDesc":136,"sizeBytes":141,"sourceHtmlUrl":142},"scripts\u002Fscan_tools.py",18637,"https:\u002F\u002Fgithub.com\u002Flinora-u\u002FAgentLoom\u002Fblob\u002Fmain\u002Fagentloom-framework-skill\u002Fscripts\u002Fscan_tools.py",{"path":144,"resourceType":135,"resourceTypeDesc":136,"sizeBytes":145,"sourceHtmlUrl":146},"scripts\u002Fvalidate_application_yaml.py",6169,"https:\u002F\u002Fgithub.com\u002Flinora-u\u002FAgentLoom\u002Fblob\u002Fmain\u002Fagentloom-framework-skill\u002Fscripts\u002Fvalidate_application_yaml.py",[148,189,198,207,229,254],{"skillNo":149,"name":150,"nameZh":6,"description":151,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":152,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":169,"publishedAt":44},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[155,158,161,164],{"categoryNo":156,"categoryName":157,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":159,"categoryName":160,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":162,"categoryName":163,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":165,"categoryName":166,"taxonomyType":167,"taxonomyTypeDesc":168},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[150,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube","with",{"skillNo":190,"name":150,"nameZh":6,"description":151,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":152,"licenseFileUrl":6,"sourceHtmlUrl":191,"categories":192,"keywords":197,"publishedAt":44},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[193,194,195,196],{"categoryNo":156,"categoryName":157,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":159,"categoryName":160,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":162,"categoryName":163,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":165,"categoryName":166,"taxonomyType":167,"taxonomyTypeDesc":168},[150,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188],{"skillNo":199,"name":150,"nameZh":6,"description":151,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":152,"licenseFileUrl":6,"sourceHtmlUrl":200,"categories":201,"keywords":206,"publishedAt":44},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[202,203,204,205],{"categoryNo":156,"categoryName":157,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":159,"categoryName":160,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":162,"categoryName":163,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":165,"categoryName":166,"taxonomyType":167,"taxonomyTypeDesc":168},[150,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188],{"skillNo":208,"name":209,"nameZh":6,"description":210,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":152,"licenseFileUrl":6,"sourceHtmlUrl":211,"categories":212,"keywords":213,"publishedAt":44},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[214,215,216,217,218,219,220,221,222,223,224,225,226,227,228],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":230,"name":231,"nameZh":6,"description":232,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":152,"licenseFileUrl":6,"sourceHtmlUrl":233,"categories":234,"keywords":236,"publishedAt":44},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[235],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[237,238,239,240,241,242,35,243,244,245,246,181,182,247,248,249,250,251,252,253],"oracle","what if oracle","go","run","ux","futures","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":255,"name":256,"nameZh":6,"description":257,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":152,"licenseFileUrl":6,"sourceHtmlUrl":258,"categories":259,"keywords":270,"publishedAt":44},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[260,263,266,267],{"categoryNo":261,"categoryName":262,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":264,"categoryName":265,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":268,"categoryName":269,"taxonomyType":167,"taxonomyTypeDesc":168},"01JBSEEDCAT000000000000036","内容创作者",[271,272,273,274,275,276,277,278,178,279,181,182,183,280,281,282,283,284,228,285],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]